{"id":66,"date":"2020-03-28T21:53:15","date_gmt":"2020-03-28T21:53:15","guid":{"rendered":"http:\/\/www.cyberlaws.org\/?p=66"},"modified":"2020-06-08T22:57:35","modified_gmt":"2020-06-08T22:57:35","slug":"hipaa-compliance-a-necessity-for-health-care-sector","status":"publish","type":"post","link":"https:\/\/www.cyberlaws.org\/hipaa-compliance-a-necessity-for-health-care-sector\/","title":{"rendered":"HIPAA COMPLIANCE FOR HEALTHCARE SECTOR"},"content":{"rendered":"<div class=\"art-postcontent clearfix\">\n<h1 style=\"text-align: justify;\"><strong>WHAT IS HIPAA?<\/strong><\/h1>\n<p style=\"text-align: justify;\">HIPAA COMPLIANCE FOR HEALTHCARE SECTOR, HIPAA (Health Insurance Portability and Accountability Act) signed by US President Bill Clinton in 1996, provides data privacy and security provisions for safeguarding medical information.<\/p>\n<h4 style=\"text-align: justify;\">HIPAA Act does the following:<\/h4>\n<ul style=\"text-align: justify;\">\n<li>HIPAA reduces health care fraud and abuse.<\/li>\n<li>HIPAA acts mandates the storage, protection and handling of handling of medical data, ensuring healthcare data is kept secure.<\/li>\n<li>HIPAA Act provides provisions for storing patient\u2019s healthcare information.<\/li>\n<li>HIPAA act is meant for protection and safeguarding unauthorised handling of PHI(Protected Health Information)<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">HIPAA COMPLIANCE FOR HEALTHCARE SECTOR is a must for healthcare solution providers. HIPAA compliance guidelines are meant to safeguard patient\u2019s health information, ensuring that it is securely stored and correctly used.<\/p>\n<p style=\"text-align: justify;\">All the sensitive data which can reveal patient identity must be kept as confidential in order to adhere HIPAA. There are set of rules of policies and privacy which the organisation need to adhere to achieve compliance.<\/p>\n<h3 style=\"text-align: justify;\"><\/h3>\n<h3 style=\"text-align: left;\"><strong>WHAT INFORMATION IS PROTECTED UNDER HIPAA?<\/strong><\/h3>\n<p style=\"text-align: justify;\">HIPPA Privacy Rule protects a patient\u2019s health information and any identifying information, in any medium or format\u2014files, email, audio, video or verbal communication. Any of the following is considered private health information:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Name of patient<\/li>\n<li>Birth date, death date or treatment dates, and any other dates relating to a patient\u2019s illness or care<\/li>\n<li>Finger and voice prints<\/li>\n<li>Social Security Number<\/li>\n<li>Photographs<\/li>\n<li>Medical records numbers<\/li>\n<li>Telephone numbers, addresses and other contact information<\/li>\n<li>Any other unique identifying number or account number<\/li>\n<\/ul>\n<h3 style=\"text-align: justify;\"><strong>WHY HIPAA <a href=\"http:\/\/www.digiyug.com\/compliance-software\/\">COMPLIANCE<\/a> IS IMPORTANT?<\/strong><\/h3>\n<p style=\"text-align: justify;\">\u00a0HIPPA compliance is a well thought of guidelines meant for safeguarding patient\u2019s .Failure to this can put patient\u2019s critical information at risk. Cyber Security breaches have catastrophic impacts on organisation\u2019s reputation, also can leads to disciplinary actions and sometimes huge penalties and fines.<\/p>\n<p style=\"text-align: justify;\">In past years ransom ware and malware attacks like WannaCry, Non Petya, have impacted millions of computers across the world, including healthcare organisation.<\/p>\n<p style=\"text-align: justify;\">Hackers exploited vulnerabilities existing in the Network devices like weak passwords, outdated versions of Operating Systems which are commonly used in healthcare sector.<\/p>\n<p style=\"text-align: justify;\">Since there is not adequate awareness and information security support in medical service providers, the attack was very easy to carry out.<\/p>\n<p style=\"text-align: justify;\">Now a day\u2019s everything is technology driven, so HIPAA also regulates some aspects of technology systems used to store, manage, and transfer healthcare information.<\/p>\n<p style=\"text-align: justify;\">The organisations that fail to implement adequate system can suffer significant damage. If any data breach incident take place, the affected organisations has to submit disclosure documents for each and every breach individually.<\/p>\n<h3 style=\"text-align: justify;\"><strong>WHO NEEDS TO BE HIPAA COMPLIANT?<\/strong><\/h3>\n<p style=\"text-align: justify;\">Following is the list of the organisation which needs to be HIPAA compliant<\/p>\n<ul style=\"text-align: justify;\">\n<li>Healthcare providers, who stores data and process PHI in electronic form.<\/li>\n<li>Clinics,<\/li>\n<li>Hospitals,<\/li>\n<li>Regional health care services,<\/li>\n<li>Medical practitioners<\/li>\n<li>Healthcare clearinghouses<\/li>\n<li>Healthcare billing services<\/li>\n<li>Community health management information system).<\/li>\n<li>This also includes any organisation which collects PHI from healthcare organisations and process it into an industry standard format.<\/li>\n<li>Health plans<\/li>\n<li>Medicaid,<\/li>\n<li>HMO (Health Maintenance Organisation),<\/li>\n<li>Insurers,<\/li>\n<li>Public health authority,<\/li>\n<li>Medicare prescription drug card sponsors,<\/li>\n<li>Universities and schools which collects, store or transmit PHI)<\/li>\n<li>Business associates of all the above<\/li>\n<li>Any organisation which handles PHI in electronic format such as vendors, contractors and infrastructure service providers.<\/li>\n<li>This also includes organisations that store or destroy (shred) documents.<\/li>\n<li>Transcription services,<\/li>\n<li>Medical equipment companies,<\/li>\n<li>Auditors and<\/li>\n<li>Accountants<\/li>\n<\/ul>\n<h3 style=\"text-align: left;\"><strong>HIPAA PRIVACY, SECURITY AND BREACH NOTIFICATION RULES<\/strong><\/h3>\n<h3 style=\"text-align: justify;\"><strong>PRIVACY RULE<\/strong><\/h3>\n<p style=\"text-align: justify;\">HIPAA Privacy rules are Standards for privacy of PHI of individuals. The main goal of HIPAA rules is to protect medical reports and other PHI(Personally identifiable health information)<\/p>\n<p style=\"text-align: justify;\">HIPAA privacy rules are applies to these types of organisations;<\/p>\n<ul style=\"text-align: justify;\">\n<li>Providers, supply chain (vendors, contractors) and service providers (data centre and cloud service providers). All healthcare Clearinghouses and health care providers shall be compliant.<\/li>\n<li>This rule also applies to healthcare service providers who conducts health related electronic transactions.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Accordingly to HIPAA privacy rule patients have legal rights over their health information.<\/p>\n<p style=\"text-align: justify;\">Below are the fundamental rights\u00a0of patients:<\/p>\n<ul style=\"text-align: justify;\">\n<li>To authorise disclosure of their health information and records.<\/li>\n<li>To request and examine a copy of their health records anytime<\/li>\n<li>To request correction to for the health records as needed<\/li>\n<\/ul>\n<h3 style=\"text-align: justify;\"><strong>SECURITY RULE<\/strong><\/h3>\n<p style=\"text-align: justify;\">HIPAA Security Rule are the Security Standards for the protection of ePHI and is a subset of privacy rule only. This rule is applicable to electronic personally identifiable health information (ePHI), which shall be protected if it is created, maintained, and received by any organisation. Covered entities shall maintain confidentiality, integrity and availability of ePHI.<\/p>\n<p style=\"text-align: justify;\">\u00a0Covered entities shall adhere all safeguards to be compliant:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Technical Safeguards:<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Access Control, Audit control, integrity control, transmission security<\/p>\n<ul style=\"text-align: justify;\">\n<li>Physical Safeguards<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Physical Access control, work station and device security, security of electronic media<\/p>\n<ul style=\"text-align: justify;\">\n<li>Administrative Safeguards:<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Security Management process, Security Manager, Information Access Management System, training and awareness, evaluation system.<\/p>\n<p>&nbsp;<\/p>\n<h3 style=\"text-align: justify;\"><strong>HIPAA BREACH NOTIFICATION RULES\u00a0<\/strong><\/h3>\n<p style=\"text-align: justify;\">Even after having adequate security measures in place, there is a possibility of breach. For such cases Breach notification rules specifies how the organisations should deal with it.<\/p>\n<p style=\"text-align: justify;\">First of all organisations should know how to define a breach. A breach is unauthorised use or disclosure of PHI forbidden by Privacy rule. The unauthorised use or disclosure of PHI is presumed to be a breach unless your organisation demonstrate there is a low probability the PHI has been compromised based on a risk and impact assessment of at least the following criteria:<\/p>\n<ul style=\"text-align: justify;\">\n<li>The extent and nature of the PHI involved, including the types of identifiers and the probability(likelihood )of re-identification<\/li>\n<li>The unauthorized individuals to whom the disclosure was made or who used the PHI<\/li>\n<li>Whether the PHI was actually acquired viewed or acquired<\/li>\n<li>The extent to which the risk associated with PHI has been mitigated<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">PHI breach notifications must be provided without unreasonable delay and no later than 60 days following the breach discovery. Notifications of smaller breaches which is affecting fewer than 500 individuals may be submitted to HHS (The United States Department of Health &amp; Human Services) annually. The HIPPA Breach Notification Rule also requires business associates like vendors, suppliers, service providers of covered entities to notify the covered entity of breaches at or by the business associate.<\/p>\n<h3><\/h3>\n<h3 style=\"text-align: justify;\"><strong>HIPAA PENALTIES<\/strong><\/h3>\n<p style=\"text-align: justify;\">As per HIPAA Privacy Rule, a healthcare data breach as well as failing to give patient\u2019s access to their PHI, could result in a fine from OCR(Office for Civil Rights)<\/p>\n<p style=\"text-align: justify;\">The minimum penalty for: HIPAA COMPLIANCE FOR HEALTHCARE SECTOR<\/p>\n<ul style=\"text-align: justify;\">\n<li>Unknowingly violating HIPAA is $100 per violation, with an annual maximum of $25,000 for repeat violations.<\/li>\n<li>Reasonable cause for violating HIPAA is $1,000 each violation, with an annual maximum of $100,000 for repeat violations.<\/li>\n<li>Wilful neglect of HIPAA, but when the violation is corrected within a given time period, is $10,000 per violation, with an annual maximum of $250,000 for repeat violations.<\/li>\n<li>Wilful neglect of HIPAA, and the violation remains uncorrected, is $50,000 per violation, with an annual maximum of $1.5 million for repeat violations.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The maximum penalty for all of these is $50,000 per violation, with an annual maximum of $1.5 million for repeat violations.<\/p>\n<p style=\"text-align: justify;\">Covered entities, organisations and individuals who intentionally \u00a0disclose or obtain PHI in violation of the HIPAA Privacy Rule can be fined up to $50,000 and receive up to one year in prison. If the HIPAA Privacy Rule is violated under false act, the penalties can be increased to a $100,000 fine and up to 10 years in prison.<\/p>\n<div class=\"mads-block\" style=\"text-align: left;\"><\/div>\n<\/div>\n<div class=\"art-postfootericons art-metadata-icons\" style=\"text-align: left;\"><span class=\"art-postcategoryicon\"><span class=\"categories\">Posted in<\/span>\u00a0blog,\u00a0Certification,\u00a0<a href=\"http:\/\/www.digiyug.com\/compliance-software\/\">Compliance<\/a>,\u00a0CYBER CRISIS,\u00a0cybersecurity,\u00a0Education,\u00a0featured,\u00a0Health Care,\u00a0HIPAA,\u00a0RISK MANAGEMENT,\u00a0startup<\/span>\u00a0|<\/div>\n<div><\/div>\n<div class=\"art-postfootericons art-metadata-icons\" style=\"text-align: left;\"><span class=\"art-posttagicon\"><span class=\"tags\">Tagged<\/span>\u00a0cyber security,\u00a0data privacy,\u00a0ePHI,\u00a0healthcare sector,\u00a0HIPAA,\u00a0HIPAA penalties,\u00a0Information Security,\u00a0PHI<\/span><\/div>\n<div><\/div>\n<div>RELEVANT LINKS<\/div>\n<div><\/div>\n<div><a href=\"https:\/\/www.cyberlaws.org\/information-security-know-what-compliance-your-organization-need\/\">INFORMATION SECURITY-KNOW WHAT COMPLIANCE YOUR ORGANIZATION NEED<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>WHAT IS HIPAA? HIPAA COMPLIANCE FOR HEALTHCARE SECTOR, HIPAA (Health Insurance Portability and Accountability Act) signed by US President Bill Clinton in 1996, provides data privacy and&#8230; <\/p>\n","protected":false},"author":1,"featured_media":69,"comment_status":"closed","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":[],"categories":[29],"tags":[8,30,31,32,24,33,14,34],"_links":{"self":[{"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/posts\/66"}],"collection":[{"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/comments?post=66"}],"version-history":[{"count":8,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/posts\/66\/revisions"}],"predecessor-version":[{"id":548,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/posts\/66\/revisions\/548"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/media\/69"}],"wp:attachment":[{"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/media?parent=66"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/categories?post=66"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cyberlaws.org\/wp-json\/wp\/v2\/tags?post=66"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}